[unisog] Re: Code Red(s) being confused with sadmind/IIS worm?
Paul L Schmehl
pauls at utdallas.edu
Fri Aug 10 16:49:55 GMT 2001
--On Friday, August 10, 2001 11:01 AM -0400 Anne Bennett
<anne at alcor.concordia.ca> wrote:
> a likely sadmind (how does one pronounce that,
> anyway?) infection at that time.
I pronounce it s-admin-d, but I suppose you could pronounce it sad mind. :-)
> (I can't *believe* the volatility of the IIS servers in
> my domain -- this week they've been appearing and disappearing at the
> rate of two per day.)
You experience isn't unique. We have never had two identical scan results.
I think it has to do with machines being turned off and on at various times
(unlike servers, these workstations aren't critical - at least their
"owners" don't think of them that way), and machines being installed
without any awareness of what's running on them.
Paul L. Schmehl, pauls at utdallas.edu
Supervisor, Support Services
The University of Texas at Dallas
AVIEN Founding Member
More information about the unisog